Legalize
Legalize / European Union / Implementing Regulation

Commission Implementing Regulation (EU) 2025/512 of 13 March 2025 on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under Regulation (EU) No 952/2013 of the European Parliament and of the Council

Type Implementing Regulation
Publication 2025-03-13
Last updated 2026-04-15
State In force
Department European Commission, TAXUD
Source EUR-Lex
articles 123
Reform history JSON API
3.

In the case of a gradual connectivity of economic operators and other persons, a Member State may offer a national convertor for the exchange of messages between the economic operator and other persons, and the customs authority of that Member State.

4.

The Commission, in collaboration with the Member States, shall draw up the technical rules which are of a business and technical nature to be applied during the NCTS transition period set out in the Annex to Implementing Decision (EU) 2023/2879, to enable mapping and interoperability between the information exchange requirements set out in Delegated Regulation (EU) 2016/341, in Delegated Regulation (EU) 2015/2446, and in Implementing Regulation (EU) 2015/2447.

CHAPTER XI

INF SPECIAL PROCEDURES SYSTEM

Article 65
Objective and structure of the INF SP system
1.

The INF Special Procedures System (‘INF SP system’) shall enable communication between the customs authorities of the Member States and the economic operators and other persons to issue and manage INF data in the domain of Special Procedures.

2.

The INF SP system shall consist of the following common components:

(a) an EU Specific Trader Portal for INF;

(b) a central INF SP system.

Article 66
Use of the INF SP system
1.

The INF SP system shall be used for economic operators and other persons to submit INF requests and to follow up on the status of such requests. The customs authorities of the Member States shall use the INF SP system to process such requests and to manage INF.

2.

The INF SP system shall enable the creation of INF by the customs authorities of the Member States and the communication between the customs authorities of Member States where needed.

3.

The INF SP system shall enable the calculation of the amount of import duties in accordance with Article 86(3) of the Code.

Article 67
Authentication and access to the central INF SP system
1.

The authentication and access verification of economic operators and other persons for the purposes of accessing the common components of the INF SP system shall be effected using the UUM&DS system.

For customs representatives to be authenticated and be able to access the common components of the INF SP system, their empowerment to act in that capacity must be registered in the UUM&DS system or in an identity and access management system set up by a Member State pursuant to Article 20 of this Regulation.

2.

The authentication and access verification of the customs authorities of the Member States for the purposes of access to the common components of the INF SP system shall be effected using the network services provided by the Commission.

3.

The authentication and access verification of the Commission’s staff for the purposes of access to the common components of the INF SP system shall be effected using the UUM&DS system or the network services provided by the Commission.

Article 68
EU Specific Trader Portal for INF
1.

The EUCTP shall provide access to the EU Specific Trader Portal for INF as referred to in Article 6 of this Regulation, where the EU Specific Trader Portal shall be an entry point to the INF SP system for economic operators and other persons.

2.

The EU Specific Trader Portal for INF shall interoperate with the central INF SP system.

Article 69
Central INF SP system
1.

The central INF SP system shall be used by the customs authorities of the Member States to exchange and store information pertaining to submitted INFs.

2.

The central INF SP system shall interoperate with the EU Specific Trader Portal for INF.

CHAPTER XII

CUSTOMS RISK MANAGEMENT SYSTEM

Article 70
Objective and structure of the CRMS
1.

The Customs Risk Management System (‘CRMS’) shall enable the communication, storage, and exchange of risk information between the Member States, Switzerland and Norway, as well as between the Member States, Switzerland, Norway and the Commission to support the implementation of the common risk management framework.

2.

A web service for national systems may be used to enable the exchange of data between the CRMS and national systems through a web interface. The CRMS shall interoperate with the ICS2 common components.

Article 71
Use of the CRMS
1.

The CRMS shall be used for the following purposes:

(a) the exchange of risk information including risk analysis results between the Member States, Switzerland and Norway, as well as between the Member States, Switzerland, Norway and the Commission, as referred to in Article 46(5) and Article 47(2) of the Code and in Article 36(1) of Implementing Regulation (EU) 2015/2447, and the storing and processing of such information;

(b) the communication between the Member States, Switzerland and Norway, as well as between the Member States, Switzerland, Norway and the Commission of the information related to the implementation of common risk criteria, priority control actions, crisis management as referred to in Article 36(2) of Implementing Regulation (EU) 2015/2447, and the submission, processing and storing of such information, including the exchange of related-risk information, the results of the risk analysis performed prior to the actions concerning priority control and crisis management, and the analysis of the results of these actions;

(c) to enable the Member States, Switzerland, Norway and the Commission to retrieve electronically from the system risk analysis reports on existing risks, on risk analysis results, and on new trends to feed into the common risk management framework and national risk management system.

2.

Where the transfer of data between the CRMS and national systems can be automated, Member States shall adapt national systems to use the CRMS web service.

Article 72
Authentication and access to the CRMS
1.

The authentication and access verification of the customs authorities of the Member States for the purposes of access to the common components of the CRMS shall be effected using the network services provided by the Commission.

2.

The authentication and access verification of the Commission’s staff for the purposes of access to the common components of the CRMS shall be effected using the UUM&DS system or the network services provided by the Commission.

Article 73
Common component of the CRMS
1.

The CRMS shall provide for risk information forms and feedback forms on risk analysis and control results to be filled in electronically in the system, processed for reporting and stored in the system. Authorised users shall be able to retrieve the forms and use them for national risk management and control purposes.

2.

The CRMS shall provide for communication mechanisms enabling users (individually or as part of an organisational unit) to provide and exchange risk information, to respond to specific requests from other users, and to provide to the Commission facts and an analysis of the results of their actions in the course of the implementation of common risk criteria, priority control actions, and crisis management.

3.

The CRMS shall provide for tools enabling the analysis and aggregation of data from risk information forms stored in the systems.

4.

The CRMS shall provide for a platform in which information, including guides, detection technology information and data, and links to other databases, relevant for risk management and controls, shall be stored and made available to authorised users for risk management and control purposes.

CHAPTER XIII

CENTRALISED CLEARANCE FOR IMPORT

Article 74
Objective and structure of the CCI
1.

The Centralised Clearance for Import (‘CCI’) shall enable communication between the customs authorities of the Member States, and between the customs authorities of the Member States and economic operators to submit and process customs declarations in the context of centralised clearance for import where more than one Member State is involved.

2.

The CCI shall consist of the following common components:

(a) a common communication network;

(b) central services.

3.

Member States shall ensure that their national CCI systems communicate through the common communication network for CCI with the national CCI systems of the other Member States and that the national CCI system includes the following national components:

(a) a national trader portal;

(b) a national CCI application;

(c) an interface with EMCS/System for Exchange of Excise Data at national level.

Article 75
Use of the CCI

The CCI system shall be used for the following purposes:

(a) to ensure the implementation of the formalities in respect of centralised clearance for import laid down in the Code, where more than one Member State is involved;

(b) to lodge and process standard customs declarations under the centralised clearance for import;

(c) to lodge and process simplified customs declarations and the respective supplementary declarations under the centralised clearance for import;

(d) to lodge and process the respective customs declarations and presentation notifications provided in the authorisation for entry in the declarant’s records under the centralised clearance for import.

Article 76
Authentication and access to the CCI
1.

Economic operators shall only have access to the national CCI systems via a national trader portal developed by the Member States. The authentication and access verification shall be determined by the Member States.

2.

The authentication and access verification of the customs authorities of the Member States for the purposes of access to the common components of the CCI system shall be effected using the network services provided by the Commission.

3.

The authentication and access verification of the Commission’s staff for the purposes of access to the common components of the CCI system shall be effected using the UUM&DS or the network services provided by the Commission.

Article 77
Common communication network of the CCI
1.

The common communication network shall ensure the electronic communication among Member States’ national CCI applications.

2.

The customs authorities of the Member States shall use the common communication network for the exchange of information relevant to CCI related import formalities.

Article 78
National trader portal
1.

The national trader portal shall allow for the exchange of information between the economic operators and the national CCI systems of the customs authorities of the Member States.

2.

The national trader portal shall interoperate with the national CCI applications.

Article 79
National CCI system
1.

The national CCI system shall be used by the customs authority of the Member State which created it for processing customs declarations under the CCI.

2.

The national CCI systems of the Member States shall communicate with each other electronically via the common domain and shall process import information received from other Member States.

CHAPTER XIV

THE REGISTERED EXPORTER SYSTEM

SECTION 1

The REX system for Member States

Article 80
Objective and structure of the REX system for Member States
1.

The Registered Exporter system (‘REX system’) for Member States shall enable the customs authorities of the Member States to register economic operators established in the Union to declare the preferential origin of goods, and to manage those registrations, namely modifications of registrations, revocations of registrations, cancellation of revocations and reporting of registrations.

2.

The REX system for Member States shall consist of the following common components:

(a) an EU Specific Trader Portal for the REX system for Member States;

(b) a central REX system for Member States.

3.

Member States may create the following national components:

(a) a national trader portal;

(b) a national Registered Exporter system (‘national REX system’).

Article 81
Use of the REX system for Member States

The REX system for Member States shall be used by exporters and the customs authorities of the Member States, in accordance with the provisions in force for the purpose of the Union preferential trade arrangements.

Article 82
Authentication and access to the REX system for Member States
1.

The authentication and access verification of economic operators and other persons for the purposes of access to the EU Specific Trader Portal for the REX system for Member States shall be effected using the UUM&DS system.

For customs representatives to be authenticated and be able to access the EU Specific Trader Portal for the REX system for Member States, their empowerment to act in that capacity shall be registered in the UUM&DS system or in an identity and access management system set up by a Member State pursuant to Article 20 of this Regulation.

2.

The authentication and access verification of Member States’ officials for the purposes of access to the central REX system for Member States shall be effected using the network services provided by the Commission.

3.

The authentication and access verification of the Commission’s staff for the purposes of access to the central REX system for Member States shall be effected using the network services provided by the Commission.

Article 83
EU Specific Trader Portal for the REX system for Member States
1.

The EU Specific Trader Portal for the REX system for Member States shall interoperate with the EUCTP, and the EUCTP shall be an entry point for requests from economic operators and other persons to the central REX system for Member States.

2.

The EU Specific Trader Portal for the REX system for Member States shall be interoperable with the central REX system for Member States and be capable of redirecting users to the national trader portal, where created by a Member State.

3.

In Member States where no national trader portal is created, the EU Specific Trader Portal for the REX system for Member States shall be used to submit and exchange information pertaining to applications for registrations and decisions of registrations, and in relation to any subsequent event which may affect the original application or registration as referred to in Article 80 of this Regulation.

Article 84
Central REX system for Member States
1.

Customs authorities of the Member States shall use the central REX system for Member States to process the applications for registrations referred to in Article 83 of this Regulation, to store the registrations, to process any subsequent event which may affect the original application or registration, or to perform queries in the registrations.

2.

The central REX system for Member States shall be interoperable with the EU Specific Trader Portal for the REX system, the customer reference services, and other relevant systems.

Article 85
National Trader Portal
1.

Where a Member State puts in place a national trader portal, economic operators and other persons shall use that portal to submit and exchange information pertaining to applications for registrations and decisions of registrations, and in relation to any subsequent event which may affect the original application or registration as referred to in Article 80 of this Regulation.

2.

A Member State that creates a national trader portal shall inform the Commission thereof.

3.

The national trader portal shall be interoperable with the national REX system.

Article 86
National REX system
1.

Customs authorities of the Member States shall use the national REX system, where created by a Member State, to process the applications for registrations referred to in Article 85 of this Regulation, to store the registrations, to process any subsequent event which may affect the original application or registration, or to perform queries in the registrations.

2.

The national REX system shall interoperate and remain synchronised with the central REX system for Member States.

SECTION 2

The REX system for third countries with which the Union has a preferential trade arrangement

Article 87
Objective and structure of the REX system for third countries with which the Union has a preferential trade arrangement
1.

The REX system for third countries with which the Union has a preferential trade arrangement (‘the REX system for third countries’) shall enable the economic operators in those countries to prepare applications for registration as registered exporters and competent authorities in those countries to process those applications, as well as to manage those registrations, namely modifications of registrations, revocations of registrations, cancellation of revocations and reporting of registrations.

2.

The REX system for third countries shall consist of the following common components:

(a) a pre-application system;

(b) a central REX system for third countries.

Article 88
Use of the REX system for third countries

The REX system for third countries shall apply in certain third countries, in accordance with the Union preferential trade arrangements.

Article 89
Authentication and access to the REX system for third countries
1.

The authentication and access verification of third countries’ officials for the purposes of access to the central REX system for third countries shall be effected using EU Login and the user management system for the REX system for third countries (T-REX).

2.

The access of economic operators and other persons to the pre-application system referred to in Article 87(2), point (a) of this Regulation, shall be anonymous.

3.

The authentication and access verification of the Commission’s staff for the purposes of access to the central REX system for third countries shall be effected using the network services provided by the Commission.

4.

Where the preferential trade arrangement of the Union is no longer applicable to a third country, the competent authorities in that third country shall retain access to the REX system for third countries for as long as required to enable those competent authorities to comply with their obligations.

Article 90
Data processing as regards the REX system for third countries

The personal data of data subjects established in third countries in the REX system for third countries registered by competent authorities in third countries shall be processed to implement and monitor the relevant preferential trade arrangement with the Union.

Article 91
Central REX system for third countries with which the Union has a preferential trade arrangement
1.

Competent authorities in the third countries with which the Union has a preferential trade arrangement shall use the central REX system for third countries to process applications for registrations, to store the registrations, to process any subsequent event which may affect the original application or registration, or to perform queries in the registrations.

2.

The central REX system for third countries shall be interoperable with the pre-application system, the customer reference services, and other relevant systems.

Article 92
Pre-application system in the REX system for third countries with which the Union has a preferential trade arrangement
1.

The pre-application system shall be an entry point for economic operators and other persons to submit electronically the data in their application to become a registered exporter. The pre-application system shall not be used for submitting requests for modification or revocation of existing registrations.

2.

The pre-application system shall interoperate with the central REX system for third countries with which the Union has a preferential trade arrangement.

CHAPTER XV

PROOF OF UNION STATUS SYSTEM

Article 93
Objective and structure of the PoUS system
1.

The Proof of Union Status System (‘PoUS system’) shall enable communication between the customs authorities of the Member States and the economic operators and other persons to issue and manage T2L/T2LF and customs goods manifests (CGM) documents as a means of proving the customs status of Union goods.

2.

The PoUS system shall consist of the following common components:

(a) an EU Specific Trader Portal for PoUS;

(b) a central PoUS system.

3.

Member States may create the following national components:

(a) a national trader portal;

(b) a national proof of Union status system (‘national PoUS system’).

Article 94
Use of the PoUS system
1.

Economic operators and other persons shall use the PoUS system:

(a) to submit requests for endorsement and registration, or registration without endorsement;

(b) to submit proof of Union status in the form of T2L/T2LF and CGM documents;

(c) to manage the use of the proof of Union status of goods upon presentation.

2.

The PoUS system shall allow for the endorsement and registration of economic operators’ and other persons’ requests and the management of the usage of the proof of Union status.

3.

The PoUS shall also enable communication between the customs authorities of the Member States to present the T2L/T2LF and CGM documents as a means to prove the customs status of Union goods.

Article 95
Authentication and access to the central PoUS system
1.

The authentication and access verification of economic operators and other persons for the purposes of accessing the common components of the PoUS system shall be effected using the UUM&DS system.

For customs representatives to be authenticated and be able to access the EU Specific Trader Portal for the PoUS system for Member States, their empowerment to act in that capacity shall be registered in the UUM&DS system or in an identity and access management system set up by a Member State pursuant to Article 20 of this Regulation.

2.

The authentication and access verification of the customs authorities of the Member States for the purposes of access to the common components of the PoUS system shall be effected using the network services provided by the Commission.

The authentication and access verification of the customs authorities of the Member States for the purposes of access to the national PoUS system shall be effected using an identity and access management system set up by the relevant Member State.

3.

The authentication and access verification of the Commission’s staff for the purposes of access to the common components of the PoUS system shall be effected using the UUM&DS system or the network services provided by the Commission.

Article 96
EU Specific Trader Portal for PoUS
1.

The EU Specific Trader Portal for PoUS shall communicate with the EUCTP, where the EUCTP shall be an entry point to the PoUS system for economic operators and other persons.

2.

The EU Specific Trader Portal for PoUS shall be interoperable with the central PoUS system.

Article 97
Central PoUS system
1.

The central PoUS system shall be used by the customs authorities of the Member States to exchange and store information pertaining to submitted T2L/T2LF and CGM documents.

2.

The central PoUS system shall be interoperable with the EU Specific Trader Portal for PoUS.

Article 98
National Trader Portal
1.

Where a Member State has created a national PoUS system in accordance with Article 93(3), point (b) of this Regulation, the national trader portal shall be the main entry point to the national PoUS system for economic operators and other persons.

2.

The national trader portal shall interoperate with the national PoUS system, where created by a Member State.

3.

The national trader portal shall provide for the functionalities equivalent to those provided for by the EU Specific Trader Portal for PoUS.

4.

A Member State that creates a national trader portal shall inform the Commission thereof.

Article 99
National PoUS system

The national PoUS system shall be interoperable with the central PoUS system to make proofs created in the national PoUS system available in the central system.

CHAPTER XVI

SURVEILLANCE SYSTEM

Article 100
Objective and structure of the Surveillance system
1.

The Surveillance system shall, in accordance with Article 56(5) of the Code and with Union law providing for its use, enable, for the purpose of customs surveillance, communication between the customs authorities of the Member States and the Commission, and the collection, storage, processing and analysis of data extracted from the customs declaration for entry into free circulation or for export of goods.

2.

Member States shall, in an automated manner, transmit the requested information from the customs declaration systems to the Surveillance system.

3.

The Surveillance system is a central system that consists of the following common components:

(a) a component for the collection, validation and storage of data;

(b) a component for performing data mining and generating information for the purpose of customs surveillance.

Article 101
Use of the Surveillance system

The data in the Surveillance system shall be used for the surveillance of the release for free circulation and export procedures which entails:

(a) supporting the Commission and the customs authorities of the Member States to ensure the uniform application of customs controls and customs legislation;

(b) minimising risks, including through data mining and the exchange of risk information;

(c) implementing specific measures prescribed by other Union provisions that have to be implemented by the customs authorities of the Member States at the border.

Article 102
Authentication and access to the Surveillance system
1.

The authentication and access verification of the customs authorities of the Member States for the purposes of access to the common components of the Surveillance system shall be effected using the network services provided by the Commission.

2.

The authentication and access verification of the Commission’s staff for the purposes of access to the common components of the Surveillance system shall be effected using the network services provided by the Commission.

Article 103
Central Surveillance system

The Member States and the Commission shall use the central Surveillance system to collect, store, process, and analyse the data referred to in Article 101 of this Regulation.

CHAPTER XVII

GUARANTEE MANAGEMENT SYSTEM

Article 104
Objective and structure of the GUM system
1.

The Guarantee Management system (‘GUM System’) shall enable the submission, processing and management of applications and decisions related to comprehensive guarantees through the CDS referred to in Article 7 of this Regulation. It shall also enable the management and monitoring of comprehensive guarantees and other guarantees, except for transit which is handled as part of the NCTS project.

2.

The GUM System shall consist of the following common components of CDS referred to in Article 7(2) of this Regulation:

(a) an EU trader portal;

(b) a central GUM system;

(c) customer reference services (CRS).

3.

Member States shall create, as a national component, a national guarantee management system (‘national GUM system’).

Article 105
Use of the GUM system
1.

The GUM system shall be used, through the CDS referred to in Article 7 of this Regulation, to submit and process applications for comprehensive guarantees, and to manage decisions related to the applications or authorisations for comprehensive guarantees.

2.

The GUM system shall also be used for the following purposes:

(a) the registration of individual guarantees and comprehensive guarantees;

(b) the management of individual guarantees and comprehensive guarantees;

(c) the monitoring of the existence of a guarantee that is provided in a Member State other than the one in which the guarantee is being used;

(d) the monitoring of the reference amount.

Article 106
Authentication and access to the central GUM system
1.

The authentication and access verification of economic operators and other persons for the purposes of access to the common components of the GUM system shall be done in accordance with Article 9 of this Regulation.

2.

The authentication and access verification of the customs authorities of the Member States for the purposes of access to the common components of the GUM system shall be done in accordance with Article 9 of this Regulation.

3.

The authentication and access verification of the customs authorities of the Member States for the purposes of access to the national GUM system shall be effected using an identity and access management system set up by the Member State concerned.

4.

The authentication and access verification of the Commission’s staff for the purposes of access to the common components of the GUM system shall be done in accordance with Article 9 of this Regulation.

Article 107
EU trader portal
1.

The EU trader portal referred to in Article 10 of this Regulation shall be an entry point to the GUM system for economic operators and other persons.

2.

The EU trader portal shall be used for the applications and authorisations related to comprehensive guarantees referred to in Article 8(1), point (b), of this Regulation, as well as the management of decisions related to those applications and authorisations.

Article 108
Central GUM system
1.

The central GUM system, using the central CDMS referred to in Article 11 of this Regulation, shall be used by the customs authorities of the Member States to manage applications and decisions related to comprehensive guarantees.

2.

The central GUM system shall interface with the national GUM system for comprehensive guarantees.

Article 109
National GUM system
1.

The national GUM system shall be used by the customs authorities of the Member States to register and manage comprehensive guarantees and to monitor the related reference amounts.

2.

The national GUM system may be used for the registration and management of other guarantees.

3.

The national GUM system shall interoperate with the national customs declaration systems where guarantees are invoked.

4.

The national GUM system may, in accordance with Article 13(3) of this Regulation, retrieve from the customer reference services the relevant business data from the respective authorisation for comprehensive guarantees.

CHAPTER XVIII

FUNCTIONING OF THE ELECTRONIC SYSTEMS AND TRAINING IN THE USE THEREOF

Article 110
Development, testing, deployment and management of the electronic systems
1.

The Commission shall develop, test, deploy and manage the common components, and the Member States may test those common components. The Member States shall develop, test, deploy and manage the national components.

2.

Member States shall ensure that the national components are interoperable with the common components.

3.

The Commission shall design and maintain the common specifications for the decentralised systems in close cooperation with the Member States.

4.

The Member States shall develop, operate, and maintain interfaces to provide the functionality for the decentralised systems necessary for the exchange of information with economic operators and other persons through national components and interfaces, and with other Member States through common components.

Article 111
Maintenance of and changes to the electronic systems
1.

The Commission shall perform the maintenance of the common components and the Member States shall perform the maintenance of their national components.

2.

The Commission and the Member States shall ensure the uninterrupted operation of the electronic systems.

3.

The Commission may change the common components of the electronic systems to correct malfunctions, to add new functionalities, or to alter existing functionalities.

4.

The Commission shall inform the Member States of changes and updates to the common components.

5.

Member States shall inform the Commission of changes and updates to the national components that may affect the functioning of the common components.

6.

The Commission and the Member States shall make the information on the changes and updates to the electronic systems set out in paragraphs 4 and 5 publicly available.

Article 112
Temporary failure of the electronic systems
1.

In the event of a temporary failure of the electronic systems referred to in Article 6(3), point (b), of the Code, economic operators and other persons shall submit the information required to fulfil the formalities concerned by the means determined by the Member States, including by means other than electronic data-processing techniques.

2.

The customs authorities of the Member States shall make sure the information submitted in accordance with paragraph 1 is made available in the respective electronic systems within 7 days of the respective electronic systems becoming available again.

3.

The Commission and the Member States shall inform each other about any unavailability of the electronic systems resulting from a temporary failure.

The Commission and the Member States shall also inform each other of the unavailability of economic operators’ systems as regards the ICS2.

4.

By way of derogation from paragraph 1, in the event of a temporary failure of the ICS2, AES, CRMS, PoUS or CCI, the business continuity plan agreed between the Member States and the Commission shall apply.

5.

With regard to the ICS2, each Member State shall decide on the activation of the business continuity plan where that Member State is affected by the temporary failure of the electronic system or where an economic operator is unable to lodge an entry summary declaration or particulars of such declaration pursuant to Article 127(4) and (6) of the Code.

6.

By way of derogation from paragraph 1, in the event of a temporary failure of the NCTS system, the business continuity procedure referred to in Annex 72-04 to Implementing Regulation (EU) 2015/2447 shall apply.

7.

By way of derogation from paragraph 2, in the event of the temporary failure of the PoUS system, the business continuity plan agreed between the Member States and the Commission shall apply.

Article 113
Training support on the use and functioning of the common components

The Commission shall support the Member States on the use and functioning of the common components of the electronic systems by providing the appropriate training material.

CHAPTER XIX

DATA PROTECTION, DATA MANAGEMENT AND THE OWNERSHIP AND SECURITY OF THE ELECTRONIC SYSTEMS

Article 114
Personal data protection
1.

The personal data registered in the electronic systems shall be processed for the purposes of implementing the customs legislation and other legislation referred to in the Code, having regard to the specific objectives of each of the electronic systems set out in Article 4, Articles 7(1), 16(1), and 21(1), Article 30, Articles 35(1), 42(1), 50(1), 57(1), 65(1), 70(1), 74(1), 80(1), 87(1), 93(1), 100(1) and 104(1) of this Regulation.

2.

The Member States’ national supervisory authorities in the field of personal data protection and the European Data Protection Supervisor shall cooperate, in accordance with Article 62 of Regulation (EU) 2018/1725, to ensure the coordinated supervision of the processing of personal data registered in the electronic systems.

3.

Any request by a data subject registered in the REX system to exercise his or her rights under Chapter III of Regulations (EU) 2016/679 and (EU) 2018/1725 shall first be submitted to the competent authorities in the third country or to the customs authorities in the Member State which registered the personal data.

Where a data subject has submitted such a request to the Commission without having tried to obtain his or her rights from the competent authorities in the third country or from the customs authorities in the Member State which registered the personal data, the Commission shall forward that request to the competent authorities in the third country or to the customs authorities in the Member State respectively which registered those data.

Where the registered exporter fails to obtain his or her rights from the competent authorities in the third country or from the customs authorities in the Member State which registered the personal data, the registered exporter shall submit such request to the Commission acting as controller as defined in Article 4, point (7), of Regulation (EU) 2016/679 and in Article 3, point (8), of Regulation (EU) 2018/1725.

Article 115
Updating of data in the electronic systems
1.

Member States shall ensure that the data registered at national level correspond to the data registered in the common components and are kept up to date.

2.

By way of derogation from paragraph 1, in respect of the ICS2, Member States shall ensure that the following data are kept up to date and correspond to the data in the ICS2 common repository:

(a) data registered at national level and communicated from the national entry system to the ICS2 common repository;

(b) data received by the national entry system from the ICS2 common repository.

Article 116
Limitation of data access and data processing
1.

The data registered in the common components of the electronic systems by a Member State may be accessed or processed by that Member State. Another Member State that is involved in the processing of an application or the management of a decision to which the data relate may also access and process those data.

2.

The data registered in the common components of the electronic systems by an economic operator or other person may be accessed or processed by that economic operator or that other person. A Member State involved in the processing of an application or the management of a decision to which the data relate may also access and process those data.

3.

The data in the ICS2 common component that are communicated to or registered in the shared trader interface by an economic operator or other person may be accessed or processed by that economic operator or that other person.

4.

The data registered in the central EBTI system by a Member State may be processed by that Member State. Another Member State which is involved in the processing of an application to which the data relate may also process those data, including by way of a consultation between the customs authorities of the Member States in accordance with Article 26 of this Regulation. The customs authorities of the Member States may access those data for the purposes of Article 25(2) of this Regulation and the Commission may access those data for the purposes of Article 21(1) of this Regulation.

5.

The data registered in the central EBTI system by an economic operator or other person may be accessed or processed by that economic operator or that person. The customs authorities of the Member States may access those data for the purposes of Article 25(2) of this Regulation and the Commission may access those data for the purposes of Article 21(1) of this Regulation.

6.

The data registered in the common component of the EORI system may be accessed and processed by the Commission. The Member State that registered those data may also access and process those data.

7.

The data in the ICS2 common components:

(a) communicated to a Member State by an economic operator or other person through the shared trader interface into the ICS2 common repository may be accessed and processed by that Member State in the ICS2 common repository, and, where needed, that Member State may also access those data that are registered in the shared trader interface;

(b) communicated to or registered in the ICS2 common repository by a Member State may be accessed or processed by that Member State;

(c) referred to in points (a) and (b) may also be accessed and processed by another Member State where that other Member State, in accordance with Article 186(2), points (a), (b) and (d), Article 186(5), (7) and (7a), and Article 189(3) and (4) of Implementing Regulation (EU) 2015/2447, is involved in the risk analysis or control process, or both, to which the data relate, with the exception of data recorded in the system by customs authorities of other Member States in relation to information on security and safety risks as referred to in Article 186(2), point (a), of Implementing Regulation (EU) 2015/2447;

(d) may be processed by the Commission in cooperation with the Member States for the purposes referred to in Article 43(2) of this Regulation and in Article 182(1), point (c), of Implementing Regulation (EU) 2015/2447, and the results of such processing may be accessed by the Commission and the Member States;

(e) may be accessed and processed by the Member States and the Commission for the purposes referred to in Article 43(3) of this Regulation, under the conditions referred to in Article 119 of this Regulation and in accordance with the specific project agreements detailing processing operations between the Member States and the Commission.

8.

The data in the ICS2 common component that are registered in the ICS2 common repository by the Commission may be accessed and processed by the Commission and Member States.

9.

The data in the Surveillance system may be accessed and processed by the Commission and Member States.

10.

The data registered in the central REX system for Member States may be accessed for the purpose of implementing and monitoring Union’s preferential trade arrangements by the customs authorities of Member States and the Commission.

11.

The data registered in the central REX system for third countries with which the Union has a preferential trade arrangement may be accessed by the following:

(a) the competent authorities of the third country in which the data have been registered;

(b) the customs authorities of Member States for the purpose of carrying out verifications of customs declarations under Article 188 of the Code or post-release control under Article 48 of the Code;

(c) the Commission for the purpose of implementing and monitoring the Union’s preferential trade arrangements.

12.

Where Member States report incidents and problems in the operational processes for the provision of the services of the systems where the Commission acts as a processor, the Commission may have access to the data only to resolve a registered incident or problem. The Commission shall ensure the confidentiality of such data in accordance with Article 12 of the Code.

13.

The data registered in the common components of the CRMS by a Member State, Switzerland, Norway or by the Commission may be accessed or processed by that Member State, Switzerland, Norway, another Member State or by the Commission to ensure the implementation of the common risk management framework in line with Article 46(5) of the Code and Article 36 of Implementing Regulation (EU) 2015/2447.

14.

The data registered in the central PoUS system may be accessed or processed by:

(a) the customs authorities of Member States in accordance with Article 93 of this Regulation;

(b) the Commission for statistical purposes.

15.

In the context of the Windsor Framework, the Union representatives may access the ICS2-data in respect of Northern Ireland.

Article 117
System ownership
1.

The Commission shall be the system owner of the common components.

2.

The Member States shall be the system owners of the respective national components.

Article 118
System security
1.

The Commission shall ensure the security of the common components. The Member States shall ensure the security of the national components.

For those purposes, the Commission and the Member States shall take the necessary measures to:

(a) prevent any unauthorised person from having access to installations used for the processing of data;

(b) prevent the entry of data and any consultation, modification, or deletion of data by unauthorised persons;

(c) detect any of the activities referred to in points (a) and (b).

2.

The Commission and the Member States shall inform each other of any activities that might result in a breach or a suspected breach of the security of the electronic systems.

3.

The Commission and the Member States shall establish security plans concerning all electronic systems.

Article 119
Controller and Processor for the systems

For the systems referred to in Article 1 of this Regulation and in relation to the processing of personal data:

(a) the Member States shall act as controllers as defined in Article 4, point (7), of Regulation (EU) 2016/679 and shall comply with the obligations set out in that Regulation;

(b) the Commission shall act as processor as defined in Article 3, point (12), of Regulation (EU) 2018/1725 and shall comply with the obligations set out in that Regulation;

(c) by way of derogation from point (b), the Commission shall act as a joint controller together with the Member States in the ICS2 when processing the data for monitoring and evaluating the implementation of the common security and safety risk criteria and standards and of the control measures and priority control in accordance with Article 116(7), point (d) of this Regulation;

(d) by way of derogation from point (b), the Commission shall act as a joint controller together with the Member States in the ICS2 when processing the data to collect, store, process, or analyse additional elements of information in conjunction with entry summary declarations and to provide support to risk management processes as referred to in Article 43(3) of this Regulation, under the conditions set out by Article 116(7), point (e), of this Regulation;

(e) by way of derogation from point (b), the Commission shall also act as a joint controller together with the Member States in the CRMS;

(g) by way of derogation from point (b), the Commission shall act as a joint controller together with the Member States in the Surveillance system.

Article 120
Data retention periods
1.

The data retention periods for the systems for which the Member States are controllers, as set out in Article 119 of this Regulation, shall be determined by those Member States, taking into account the requirements of the customs legislation. The Member States shall inform the Commission of those retention periods.

2.

The following data retention periods shall apply to the following systems for which the Commission and Member States are joint controllers:

(a) for the ICS2, to monitor and evaluate the implementation of the common security and safety risk criteria and standards, of the control measures and priority control areas referred to in Article 43(2), and to support the risk management processes referred in Article 43(3) of this Regulation, a retention period of 10 years starting from the moment the data are processed in the central system for the first time;

(b) for the REX system, to allow for the notification of the customs debt for a maximum period of 10 years in accordance with Article 103(2) of the Code, a revoked registration shall be retained in the REX system for a maximum period of 10 years starting from 1 January of the year after the year in which the revocation took place, and, after the expiry of that period, the competent authority of a third country or the customs authorities of the Member State having revoked the registration shall delete the registration data. However, if all registrations in a beneficiary country of the Generalized System of Preference were revoked in accordance with Article 90(1) of Implementing Regulation (EU) 2015/2447, and if the beneficiary country has not been a beneficiary country of the Generalized System of Preferences of Norway, Switzerland or Türkiye for more than 10 years, the Commission shall delete the registration data;

(c) for the CRMS, to ensure the protection of the security and safety of citizens and the protection of the financial interests of the Union and its Member States, a retention period of 10 years starting from the moment the data are processed in the central system for the first time;

(d) for the Surveillance system, to ensure the protection of the financial interests of the Union and its Member States and the trade and all other Union policies that are based on the data retrieved by means of surveillance, a retention period of 10 years starting from the moment the data are processed in the central system for the first time.

However, where court proceedings or an appeal involving data stored in the electronic systems referred to in points (a) to (d) have begun, those data shall be retained until the appeal procedure or court proceedings are terminated.

3.

The data retention period shall be applicable to all data covered by the electronic systems.

CHAPTER XX

FINAL PROVISIONS

Article 121
Assessment of the electronic systems

The Commission and the Member States shall assess the components for which they are responsible and shall analyse the security and integrity of those components and the confidentiality of the data processed within those components.

The Commission and the Member States shall inform each other of the results of those assessments.

Article 122
Repeal

Implementing Regulation (EU) 2023/1070 is repealed.

References to the repealed Implementing Regulation shall be construed as references to this Regulation.

Article 123
Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 13 March 2025.

For the Commission The President Ursula VON DER LEYEN

(1) OJ L 269, 10.10.2013, p. 1.

(2) Commission Implementing Decision (EU) 2023/2879 of 15 December 2023 establishing the Work Programme relating to the development and deployment for the electronic systems provided for in the Union Customs Code (OJ L, 2023/2879, 22.12.2023, ELI: http://data.europa.eu/eli/dec_impl/2023/2879/oj).

(3) Decision No 6/2020 of the Joint Committee established by the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community of 17 December 2020 providing for the practical working arrangements relating to the exercise of the rights of Union representatives referred to in Article 12(2) of the Protocol on Ireland/Northern Ireland [2020/2250] (OJ L 443, 30.12.2020, p. 16, ELI: http://data.europa.eu/eli/dec/2020/2250/oj).

(4) The Protocol on Ireland/Northern Ireland annexed to the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community (OJ L 29, 31.1.2020, p. 7, ELI: http://data.europa.eu/eli/treaty/withd_2020/sign) is referred to as the Windsor Framework pursuant to Joint Declaration No 1/2023 of the Union and the United Kingdom in the Joint Committee established by the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community of 24 March 2023 (OJ L 102, 17.4.2023, p. 87).

(5) Agreement on the European Economic Area – Final Act – Joint Declarations – Declarations by the Governments of the Member States of the Community and the EFTA States – Arrangements – Agreed Minutes – Declarations by one or several of the Contracting Parties of the Agreement on the European Economic Area (OJ L 1, 3.1.1994, p. 3, ELI: http://data.europa.eu/eli/agree_internation/1994/1/oj).

(6) Decision of the EEA Joint Committee No 76/2009 of 30 June 2009 amending Protocol 10 on simplification of inspections and formalities in respect of carriage of goods and Protocol 37 containing the list provided for in Article 101 (OJ L 232, 3.9.2009, p. 40, ELI: http://data.europa.eu/eli/dec/2009/76(2)/oj).

(7) Decision No 1/2021 of the EU-Switzerland Joint Committee of 12 March 2021 amending Chapter III of, and Annexes I and II to, the Agreement between the European Community and the Swiss Confederation on the simplification of inspections and formalities in respect of the carriage of goods and on customs security measures [2021/714] (OJ L 152, 3.5.2021, p 1, ELI: http://data.europa.eu/eli/dec/2021/714/oj).

(8) Commission Implementing Regulation (EU) 2015/2447 of 24 November 2015 laying down detailed rules for implementing certain provisions of Regulation (EU) No 952/2013 of the European Parliament and of the Council laying down the Union Customs Code (OJ L 343, 29.12.2015, p. 558, ELI: http://data.europa.eu/eli/reg_impl/2015/2447/oj).

(9) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj).

(10) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj).

(11) Commission Implementing Regulation (EU) 2023/1070 of 1 June 2023 on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under Regulation (EU) No 952/2013 of the European Parliament and the Council (OJ L 143, 2.6.2023, p. 65, ELI: http://data.europa.eu/eli/reg_impl/2023/1070/oj).

(12) Commission Delegated Regulation (EU) 2015/2446 of 28 July 2015 supplementing Regulation (EU) No 952/2013 of the European Parliament and of the Council as regards detailed rules concerning certain provisions of the Union Customs Code (OJ L 343, 29.12.2015, p. 1, ELI: http://data.europa.eu/eli/reg_del/2015/2446/oj).

(13) Regulation (EU) 2022/2399 of the European Parliament and of the Council of 23 November 2022 establishing the European Union Single Window Environment for Customs and amending Regulation (EU) No 952/2013 (OJ L 317, 9.12.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2399/oj).

(14) Council Directive (EU) 2020/262 of 19 December 2019 laying down the general arrangements for excise duty (OJ L 58, 27.2.2020, p. 4, ELI: http://data.europa.eu/eli/dir/2020/262/oj).

(15) Commission Delegated Regulation (EU) 2016/341 of 17 December 2015 supplementing Regulation (EU) No 952/2013 of the European Parliament and of the Council as regards transitional rules for certain provisions of the Union Customs Code where the relevant electronic systems are not yet operational and amending Delegated Regulation (EU) 2015/2446 (OJ L 69, 15.3.2016, p. 1, ELI: http://data.europa.eu/eli/reg_del/2016/341/oj).

(16) Convention between the European Economic Community, the Republic of Austria, the Republic of Finland, the Republic of Iceland, the Kingdom of Norway, the Kingdom of Sweden and the Swiss Confederation, on a common transit procedure (OJ L 226, 13.8.1987, p. 2, ELI: http://data.europa.eu/eli/convention/1987/415/oj).

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.